How to give the same error message when the wrong password or wrong username is used?
You can use login_errors filter for changing the custom error message Please have a look at Change login error messages
security
Session Cookie security questions
The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID). wp_generate_auth_cookie() (generates your cookies) wp_set_auth_cookie (actually sets the cookies) wp_validate_auth_cookie() (validates your cookies) wp_parse_auth_cookie (parses an auth cookie, … Read more
How can I force a specific password?
You can use this code in your functions.php to restrict users below admin level from changing their passwords: if ( is_admin() ) { add_action( ‘init’, ‘disable_password_fields’, 10 ); } function disable_password_fields() { if ( ! current_user_can( ‘activate_plugins’ ) ) { $show_password_fields = add_filter( ‘show_password_fields’, ‘__return_false’ ); } } The admin should probably register each user … Read more
.htaccess password protection bypassed
What web server you use? If use nginx, you can try this to secure your wp-admin : location ~ ^/(wp-login\.php$) { root /var/www/wordpress/; allow 127.0.0.1; allow Your-ip-address; allow Your-second-ip-address; deny all; Other way to secure your wp-admin from brute force attacks is to add this lines to your nginx.conf : Limit Request limit_req_status 403; limit_req_zone … Read more
Use Google authentication for pages within a website [closed]
If you can use google authentication to connect as admin, then accessing published site pages are no different than connecting to a different user role. Make a new user role (say subscriber) and make your pages accessible to that particular role based users only. Make sure they don’t have access to anything else than these … Read more
Is it safe to give wordpress directories ownership to www-data?
No, it is not safe as it means that any security breach might end up in your code being changed. Alternatives: There is nothing wrong in using SFTP to upload changed plugins. If it is something that might take long time, you can manually put wordpress into maintenance mode by adding a file named .maintenance … Read more
fail2ban to prevent Brute Force Attacks on WordPress?
[pedantic mode] fail2ban obviously do not prevent attacks. The only way to prevent attacks is by sending the people that originate them to jail or give them some other incentive to stop. More to the point, fail2ban suffers from having only a single point of reference while attackers control many sources. To have an effective … Read more
White screen of death on admin pages after moving wp-config up two levels for security
wp-config.php includes files, it’s not just a config file, and WordPress isn’t built to allow putting the file 2 levels up. However, WordPress already supports loading wp-config.php from 1 level up. With all of this in mind though, this is only really a protection if you’re worried about mis-configuring your server. Unless PHP execution is … Read more
Will there be security updates for WordPress 4.9.9
According to Codex: The only current officially supported version is WordPress 5.0.3. Previous major releases before this may or may not get security updates as serious exploits are discovered. So, as you can see, the official version is that only the newest version is supported and only that version guarantees that you’ll get security updates. … Read more
Does meta-data need to be sanitized?
Yes, it’s a good practice to sanitize input and escape output. It’s important to use the correct function, though, so that you don’t inadvertently mess up your data. Since it’s for a URL, use esc_url_raw() (it is specifically for db usage). (Note: it may seem odd using a function with the “esc_” stem for sanitizing, … Read more